ZachXBT names Crédit Mutuel Arkéa as suspected victim of $133M crypto theft

BlockchainБлокчейнA blockchain is a distributed database in the form of a chain of blocks, where each record is cryptographically linked to the previous one, and copies are stored by many network participants. investigator ZachXBT has named French banking group Crédit Mutuel Arkéa as the alleged victim of a crypto theft of more than $133 million. The bank has not publicly confirmed the theft or its involvement. According to the investigator, the attack lasted several days, and the final amount could be higher once over-the-counter (OTCOTCOTC (Over-the-Counter) is an off-exchange trade executed directly between two parties or through an OTC desk, rather than on the exchange's public order book.) activity is counted.

How the theft unfolded

According to ZachXBT, an unnamed entity in the European Union may have lost more than $106 million from accounts at several crypto exchanges on November 1. The funds were withdrawn as USDCUSDCUSDC (USD Coin) is a stablecoin issued at a 1:1 ratio to the US dollar and backed by cash reserves and short-term US Treasury bonds. and USDTUSDTUSDT (Tether) is a stablecoin pegged to the US dollar and issued by Tether. It is used for settlements and transfers in the crypto industry.. The attacker then swapped USDC for ETHЭфириумEthereum is a blockchain platform with programmable smart contracts and its own cryptocurrency, ETH, which is used to pay network fees., moved funds through instant exchanges, converted some into the privacy coin Monero, and bridged assets across multiple blockchains.

On Tuesday, ZachXBT said he had identified a further $27 million in exchange withdrawalsВывод средствWithdrawal is the transfer of a player's or customer's balance from the platform's internal account to an external payment instrument: a card, e-wallet, bank account, or crypto wallet., bringing the totalТоталTotal is a bet on the total number of points, goals, games or other events in a match relative to the bookmaker's line: over or under. above $133 million. Some of those withdrawals, he said, took place after his initial disclosure. He published four Ethereum addresses that he linked to the theft. CoinDesk reported that Crypto.com has confirmed it blocked funds linked to the theft.

Why disclosure timing matters

ZachXBT argues the incident was not properly disclosed. In his assessment, this prevented law enforcement from freezing around $30 million in stolen funds. He did not say how he identified the bank or how the attacker gained access to the exchange accounts.

His working theory is that a large financial institution in Western Europe was exploited and that the incident is being covered up. He has not identified the attacker but said he could say with a high degree of confidence that it is not the Lazarus Group, based on several laundering indicators.

Context: MiCA and major thefts

Citing L'Agefi, Decrypt reported that in May Crédit Mutuel Arkéa applied for a license under MiCAMiCAMiCA (Markets in Crypto-Assets) is EU Regulation 2023/1114, which sets unified rules for issuing, offering and providing services related to crypto-assets across EU member states., the EU's crypto regulation, to offer crypto services to retail clients and provide them on a white-label basis through its Arkéa Banking Services division.

The allegation surfaced days after the $6.3 billion Binance hack, which the FBI has attributed to North Korean hackers and which is the largest crypto theft on record. Cointelegraph also noted that the bank has not confirmed any involvement in the incident.